# extending connection record type

**URL:** <https://community.zeek.org/t/extending-connection-record-type/1843>\
**Category:** Development\
**Tags:** development\
**Created:** [March 22, 2011, 1:38pm UTC](https://community.zeek.org/t/extending-connection-record-type/1843 "2011-03-22T13:38:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\
**Post date:** [March 22, 2011, 1:38pm UTC](https://community.zeek.org/t/extending-connection-record-type/1843/1 "2011-03-22T13:38:28Z")

</div>

This is sort of an extension on the previous email, but sort of a different topic at the same time.

In the active\_conns thread, Robin mentioned the idea of extending the connection record to include these state tracking records directly within it. At first I was going to say that I didn't like the idea because it made state tracking less "regular" in that the cases where state not related to a connection is being tracked, the fall back would be to use a global table with some index.

As I thought about it more and wrote some code for how it would look to use it, I realized that I liked the idea more and more. For starters, non-connection oriented state tracking is a bit of an exception in many cases and secondly, there is quite a bit less indexing into tables that needs to be done, and lastly, the syntax is much cleaner and nicer to look at and use. Here are some examples:

Currently...  
HTTP::active\_conns[c$id]$log$uri;

By extending the connection record...  
c$http$uri;

Using Robin's code to extend records is easy and fairly clean looking too...

redef record connection += {  
&nbsp;&nbsp;http::Info;  
};

This has the additional benefit of providing a very easy way for script writers to find out if some certain functionality is available with the field existence testing operator (?$) by checking to see if the http structure is available (for example) by doing c?$http. It's much clearer in it's intent than some of the existing hacks like using @ifdef to find if some variable exists.

If we combine this proposal with the &log attribute proposal, I think we can make some very clean interfaces for interacting with data and making it really easy to understand and expand on the scripts that we ship.

Thoughts?

&nbsp;&nbsp;.Seth

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/extending-connection-record-type/1843/2 "2022-05-06T15:39:30Z")

</div>

Closed on May 6, 2022, 3:39pm UTC